# Configure RBAC using the REST API in Confluent Platform Use the sample curl statements below to configure RBAC for different components using the REST API. #### NOTE The guidance here is based on the assumption that you are using default topics and cluster IDs. Replace all variable entries (in `<>`) with values from your installation. ## Schema Registry To configure RBAC for Schema Registry using the REST API: 1. Get the MDS token: ```none curl --cacert --key --cert -u : -s https://:8090/security/1.0/authenticate ``` 2. Grant the Security Admin role to a Schema Registry user: ```none curl --cacert --key --cert -X POST https://:8090/security/1.0/principals/User:/roles/SecurityAdmin -H "accept: application/json" -H "Authorization: Bearer " -H "Content-Type: application/json" -d '{"clusters":{"kafka-cluster":"","schema-registry-cluster":""}} ``` 3. Grant the Resource Owner role to the group that Schema Registry nodes use to coordinate access across the cluster: ```none curl --cacert --key --cert -X POST https://:8090/security/1.0/principals/User:/roles/ResourceOwner/bindings -H "accept: application/json" -H "Authorization: Bearer " -H "Content-Type: application/json" -d '{"scope":{"clusters":{"kafka-cluster": ""}}, "resourcePatterns":[{"resourceType":"Group","name": "schema-registry","patternType":"LITERAL"}]}' ``` ## Connect To configure [Connect RBAC](../../../connect/rbac/connect-rbac-getting-started.md#connect-rbac-getting-started) role bindings using the REST API: 1. Get the MDS token: ```none curl --cacert --key --cert -u : -s https://:8090/security/1.0/authenticate ``` 2. Grant the Security Admin role to a Connect cluster: ```none curl --cacert --key --cert -X POST https://:8090/security/1.0/principals/User:/roles/SecurityAdmin -H "accept: application/json" -H "Authorization: Bearer " -H "Content-Type: application/json" -d '{"clusters":{"kafka-cluster":"","connect-cluster":""}} ``` 3. Grant the Connect user the ResourceOwner role on the group that Connect nodes use to coordinate across the cluster: ```none curl --cacert --key --cert -X POST https://:8090/security/1.0/principals/User:/roles/ResourceOwner/bindings -H "accept: application/json" -H "Authorization: Bearer " -H "Content-Type: application/json" -d '{"scope":{"clusters":{"kafka-cluster":""}},"resourcePatterns":[{"resourceType":"Group","name":"connect-cluster","patternType":"LITERAL"}]}' ``` 4. Grant the Resource Owner role on the configuration storage topic: ```none curl --cacert --key --cert -X POST https://:8090/security/1.0/principals/User:/roles/ResourceOwner/bindings -H "accept: application/json" -H "Authorization: Bearer " -H "Content-Type: application/json" -d '{"scope":{"clusters":{"kafka-cluster":""}},"resourcePatterns":[{"resourceType":"Topic","name":"connect-configs","patternType":"LITERAL"}]}' ``` 5. Grant the Resource Owner role on the offset storage topic: ```none curl --cacert --key --cert -X POST https://:8090/security/1.0/principals/User:/roles/ResourceOwner/bindings -H "accept: application/json" -H "Authorization: Bearer " -H "Content-Type: application/json" -d '{"scope":{"clusters":{"kafka-cluster":""}},"resourcePatterns":[{"resourceType":"Topic","name":"connect-offsets","patternType":"LITERAL"}]}' ``` 6. Grant the Resource Owner role on the status storage topic: ```none curl --cacert --key --cert -X POST https://:8090/security/1.0/principals/User:/roles/ResourceOwner/bindings -H "accept: application/json" -H "Authorization: Bearer " -H "Content-Type: application/json" -d '{"scope":{"clusters":{"kafka-cluster":""}},"resourcePatterns":[{"resourceType":"Topic","name":"connect-status","patternType":"LITERAL"}]}' ``` ## ksqlDB To configure RBAC for ksqlDB using the REST API: 1. Get the MDS token: ```none curl --cacert --key --cert -u : -s https://:8090/security/1.0/authenticate ``` 2. Grant the Security Admin role to a ksqlDB user: ```none curl --cacert --key --cert -X POST https://:8090/security/1.0/principals/User:/roles/SecurityAdmin -H "accept: application/json" -H "Authorization: Bearer " -H "Content-Type: application/json" -d '{"clusters":{"kafka-cluster":"","ksql-cluster":"default_"}}' ``` 3. Grant the Resource Owner role to the ksqlDB user on the ksqlDB cluster: ```none curl --cacert --key --cert -X POST https://:8090/security/1.0/principals/User:/roles/ResourceOwner/bindings -d '{ "scope": {"clusters": {"kafka-cluster":"","ksql-cluster":"default_"}},"resourcePatterns":[{"resourceType": "KsqlCluster","name": "ksql-cluster"}]}' -H "Content-Type: application/json" -H "Authorization: Bearer " ``` 4. Grant the Resource Owner role to the ksqlDB user with three resourcePatterns: ```none curl --cacert --key --cert -X POST https://:8090/security/1.0/principals/User:/roles/ResourceOwner/bindings -d '{ "scope": {"clusters": {"kafka-cluster":""}}, "resourcePatterns": [{"resourceType": "Topic", "name": "confluent-ksql-defaultcommand_topic","patternType":"LITERAL"},{"resourceType":"Topic","name":"default-ksql_processing_log","patternType":"LITERAL"},{"resourceType":"Group","name":"confluent-ksql-default","patternType":"PREFIXED"}]}' -H "Content-Type: application/json" -H "Authorization: Bearer " ``` ## Confluent Control Center To configure RBAC for Control Center using the REST API: 1. Get the MDS token: ```none curl --cacert --key --cert -u : -s https://:8090/security/1.0/authenticate ``` 2. Grant the System Admin role to the Control Center user: ```none curl --cacert --key --cert -X POST https://:8090/security/1.0/principals/User:/roles/SystemAdmin -H "accept: application/json" -H "Authorization: Bearer " -H "Content-Type: application/json" -d '{"clusters": {"kafka-cluster": ""}}' ``` ## Confluent Platform for Apache Flink RBAC for Flink can be configured using the Confluent CLI, which is the most common and recommended approach. However, you can use the MDS REST API if you need automation or integration with custom tooling. With Flink, Confluent Manager for Apache Flink® (CMF) enforces authorization by calling MDS. RBAC role bindings are stored centrally in MDS. 1. Get the MDS token: ```none curl --cacert --key --cert -u : -s https://:8090/security/1.0/authenticate ``` 2. Grant roles. For example, to grant the `SecurityAdmin` role to a Flink `User:1` you would: ```none curl --cacert --key --cert -X POST https://:8090/security/1.0/principals/User:/roles/SecurityAdmin -H "accept: application/json" -H "Authorization: Bearer " -H "Content-Type: application/json" -d '{ "clusters": { "kafka-cluster": "", "flink-cluster": "default_" }}' ```